1. #!/bin/bash
    2. DATE=$(date +%d/%b/%Y:%H:%M)
    3. LOG_FILE=/usr/local/nginx/logs/demo2.access.log
    4. ABNORMAL_IP=$(tail -n5000 $LOG_FILE |grep $DATE |awk '{a[$1]++}END{for(i in a)if(a[i]>10)print i}')
    5. for IP in $ABNORMAL_IP; do
    6. if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
    7. iptables -I INPUT -s $IP -j DROP
    8. echo "$(date +'%F_%T') $IP" >> /tmp/drop_ip.log
    9. fi
    10. done